From e81318a663ccfc77cfaa17debfd494bb1743426a Mon Sep 17 00:00:00 2001
From: viettranx <viettranx@gmail.com>
Date: Wed, 25 Mar 2026 07:51:14 +0700
Subject: [PATCH] refactor(store): migrate all tenantClauseN callers to
 scopeClause

Migrate 72 calls across 16 files from tenantClauseN/tenantClauseNAlias
to scopeClause/scopeClauseAlias. Old functions retained in helpers.go
as definitions only (no callers). All store queries now use the
scope-based helpers, ready for project-level scoping when needed.
---
 internal/store/pg/agents.go                   |  2 +-
 internal/store/pg/agents_context.go           | 14 ++++-----
 internal/store/pg/config_permissions.go       |  8 ++---
 internal/store/pg/cron_crud.go                |  2 +-
 internal/store/pg/knowledge_graph.go          | 30 +++++++++----------
 .../store/pg/knowledge_graph_embedding.go     |  2 +-
 .../store/pg/knowledge_graph_traversal.go     |  4 +--
 internal/store/pg/mcp_servers_access.go       | 16 +++++-----
 internal/store/pg/memory_admin.go             | 10 +++----
 internal/store/pg/memory_docs.go              | 16 +++++-----
 internal/store/pg/memory_search.go            |  8 ++---
 internal/store/pg/pending_message_store.go    | 10 +++----
 internal/store/pg/skills_embedding.go         |  2 +-
 internal/store/pg/skills_grants.go            | 10 +++----
 internal/store/pg/teams.go                    |  6 ++--
 15 files changed, 70 insertions(+), 70 deletions(-)

diff --git a/internal/store/pg/agents.go b/internal/store/pg/agents.go
index b9c5b5c2..52f2722f 100644
--- a/internal/store/pg/agents.go
+++ b/internal/store/pg/agents.go
@@ -263,7 +263,7 @@ func (s *PGAgentStore) List(ctx context.Context, ownerID string) ([]store.AgentD
 		argIdx++
 	}
 
-	if clause, targs, err := tenantClauseN(ctx, argIdx); err == nil && clause != "" {
+	if clause, targs, _, err := scopeClause(ctx, argIdx); err == nil && clause != "" {
 		q += clause
 		args = append(args, targs...)
 		argIdx++
diff --git a/internal/store/pg/agents_context.go b/internal/store/pg/agents_context.go
index 6cab78b6..26d4bbae 100644
--- a/internal/store/pg/agents_context.go
+++ b/internal/store/pg/agents_context.go
@@ -17,7 +17,7 @@ import (
 // --- Agent-level Context Files ---
 
 func (s *PGAgentStore) GetAgentContextFiles(ctx context.Context, agentID uuid.UUID) ([]store.AgentContextFileData, error) {
-	tClause, tArgs, err := tenantClauseN(ctx, 2)
+	tClause, tArgs, _, err := scopeClause(ctx, 2)
 	if err != nil {
 		return nil, err
 	}
@@ -53,7 +53,7 @@ func (s *PGAgentStore) SetAgentContextFile(ctx context.Context, agentID uuid.UUI
 // PropagateContextFile copies an agent-level context file to all existing user
 // instances that already have that file (seeded users). Returns updated row count.
 func (s *PGAgentStore) PropagateContextFile(ctx context.Context, agentID uuid.UUID, fileName string) (int, error) {
-	tClause, tArgs, err := tenantClauseN(ctx, 4)
+	tClause, tArgs, _, err := scopeClause(ctx, 4)
 	if err != nil {
 		return 0, err
 	}
@@ -79,7 +79,7 @@ func (s *PGAgentStore) PropagateContextFile(ctx context.Context, agentID uuid.UU
 // --- Per-user Context Files ---
 
 func (s *PGAgentStore) GetUserContextFiles(ctx context.Context, agentID uuid.UUID, userID string) ([]store.UserContextFileData, error) {
-	tClause, tArgs, err := tenantClauseN(ctx, 3)
+	tClause, tArgs, _, err := scopeClause(ctx, 3)
 	if err != nil {
 		return nil, err
 	}
@@ -113,7 +113,7 @@ func (s *PGAgentStore) SetUserContextFile(ctx context.Context, agentID uuid.UUID
 }
 
 func (s *PGAgentStore) DeleteUserContextFile(ctx context.Context, agentID uuid.UUID, userID, fileName string) error {
-	tClause, tArgs, err := tenantClauseN(ctx, 4)
+	tClause, tArgs, _, err := scopeClause(ctx, 4)
 	if err != nil {
 		return err
 	}
@@ -165,7 +165,7 @@ func (s *PGAgentStore) EnsureUserProfile(ctx context.Context, agentID uuid.UUID,
 // --- User Instances ---
 
 func (s *PGAgentStore) ListUserInstances(ctx context.Context, agentID uuid.UUID) ([]store.UserInstanceData, error) {
-	tClause, tArgs, err := tenantClauseNAlias(ctx, 2, "p")
+	tClause, tArgs, _, err := scopeClauseAlias(ctx, 2, "p")
 	if err != nil {
 		return nil, err
 	}
@@ -215,7 +215,7 @@ func (s *PGAgentStore) UpdateUserProfileMetadata(ctx context.Context, agentID uu
 	if err != nil {
 		return err
 	}
-	tClause, tArgs, err := tenantClauseN(ctx, 4)
+	tClause, tArgs, _, err := scopeClause(ctx, 4)
 	if err != nil {
 		return err
 	}
@@ -230,7 +230,7 @@ func (s *PGAgentStore) UpdateUserProfileMetadata(ctx context.Context, agentID uu
 // --- User Overrides ---
 
 func (s *PGAgentStore) GetUserOverride(ctx context.Context, agentID uuid.UUID, userID string) (*store.UserAgentOverrideData, error) {
-	tClause, tArgs, err := tenantClauseN(ctx, 3)
+	tClause, tArgs, _, err := scopeClause(ctx, 3)
 	if err != nil {
 		return nil, err
 	}
diff --git a/internal/store/pg/config_permissions.go b/internal/store/pg/config_permissions.go
index 5dfe9d75..9e709e82 100644
--- a/internal/store/pg/config_permissions.go
+++ b/internal/store/pg/config_permissions.go
@@ -81,7 +81,7 @@ func (s *PGConfigPermissionStore) CheckPermission(ctx context.Context, agentID u
 	s.mu.RUnlock()
 
 	// Fetch from DB.
-	tClause, tArgs, err := tenantClauseN(ctx, 3)
+	tClause, tArgs, _, err := scopeClause(ctx, 3)
 	if err != nil {
 		return false, err
 	}
@@ -171,7 +171,7 @@ func (s *PGConfigPermissionStore) Grant(ctx context.Context, perm *store.ConfigP
 }
 
 func (s *PGConfigPermissionStore) Revoke(ctx context.Context, agentID uuid.UUID, scope, configType, userID string) error {
-	tClause, tArgs, err := tenantClauseN(ctx, 5)
+	tClause, tArgs, _, err := scopeClause(ctx, 5)
 	if err != nil {
 		return err
 	}
@@ -186,7 +186,7 @@ func (s *PGConfigPermissionStore) Revoke(ctx context.Context, agentID uuid.UUID,
 }
 
 func (s *PGConfigPermissionStore) List(ctx context.Context, agentID uuid.UUID, configType, scope string) ([]store.ConfigPermission, error) {
-	tClause, tArgs, err := tenantClauseN(ctx, 0) // paramN unused; we append manually
+	tClause, tArgs, _, err := scopeClause(ctx, 0) // paramN unused; we append manually
 	if err != nil {
 		return nil, err
 	}
@@ -233,7 +233,7 @@ func (s *PGConfigPermissionStore) ListFileWriters(ctx context.Context, agentID u
 	}
 	s.fwMu.RUnlock()
 
-	tClause, tArgs, err := tenantClauseN(ctx, 3)
+	tClause, tArgs, _, err := scopeClause(ctx, 3)
 	if err != nil {
 		return nil, err
 	}
diff --git a/internal/store/pg/cron_crud.go b/internal/store/pg/cron_crud.go
index 1eef96ad..db6807b7 100644
--- a/internal/store/pg/cron_crud.go
+++ b/internal/store/pg/cron_crud.go
@@ -120,7 +120,7 @@ func (s *PGCronStore) ListJobs(ctx context.Context, includeDisabled bool, agentI
 		args = append(args, userID)
 		argIdx++
 	}
-	clause, targs, tErr := tenantClauseN(ctx, argIdx)
+	clause, targs, _, tErr := scopeClause(ctx, argIdx)
 	if tErr != nil {
 		slog.Warn("cron.ListJobs: tenant context missing, returning empty (fail-closed)", "error", tErr)
 		return nil
diff --git a/internal/store/pg/knowledge_graph.go b/internal/store/pg/knowledge_graph.go
index 55bfe98d..95bac930 100644
--- a/internal/store/pg/knowledge_graph.go
+++ b/internal/store/pg/knowledge_graph.go
@@ -64,7 +64,7 @@ func (s *PGKnowledgeGraphStore) GetEntity(ctx context.Context, agentID, userID,
 	eid := mustParseUUID(entityID)
 
 	if store.IsSharedKG(ctx) {
-		tc, tcArgs, err := tenantClauseN(ctx, 3)
+		tc, tcArgs, _, err := scopeClause(ctx, 3)
 		if err != nil {
 			return nil, err
 		}
@@ -77,7 +77,7 @@ func (s *PGKnowledgeGraphStore) GetEntity(ctx context.Context, agentID, userID,
 		return scanEntity(row)
 	}
 
-	tc, tcArgs, err := tenantClauseN(ctx, 4)
+	tc, tcArgs, _, err := scopeClause(ctx, 4)
 	if err != nil {
 		return nil, err
 	}
@@ -94,7 +94,7 @@ func (s *PGKnowledgeGraphStore) DeleteEntity(ctx context.Context, agentID, userI
 	aid := mustParseUUID(agentID)
 	eid := mustParseUUID(entityID)
 	if store.IsSharedKG(ctx) {
-		tc, tcArgs, err := tenantClauseN(ctx, 3)
+		tc, tcArgs, _, err := scopeClause(ctx, 3)
 		if err != nil {
 			return err
 		}
@@ -104,7 +104,7 @@ func (s *PGKnowledgeGraphStore) DeleteEntity(ctx context.Context, agentID, userI
 		)
 		return err
 	}
-	tc, tcArgs, err := tenantClauseN(ctx, 4)
+	tc, tcArgs, _, err := scopeClause(ctx, 4)
 	if err != nil {
 		return err
 	}
@@ -136,7 +136,7 @@ func (s *PGKnowledgeGraphStore) ListEntities(ctx context.Context, agentID, userI
 		args = append(args, opts.EntityType)
 		idx++
 	}
-	tc, tcArgs, err := tenantClauseN(ctx, idx)
+	tc, tcArgs, _, err := scopeClause(ctx, idx)
 	if err != nil {
 		return nil, err
 	}
@@ -228,7 +228,7 @@ func (s *PGKnowledgeGraphStore) ilikeSearchEntities(ctx context.Context, agentID
 		args = append(args, userID)
 		idx++
 	}
-	tc, tcArgs, err := tenantClauseN(ctx, idx)
+	tc, tcArgs, _, err := scopeClause(ctx, idx)
 	if err != nil {
 		return nil, err
 	}
@@ -283,7 +283,7 @@ func (s *PGKnowledgeGraphStore) vectorSearchEntities(ctx context.Context, embedd
 		args = append(args, userID)
 		idx++
 	}
-	tc, tcArgs, err := tenantClauseN(ctx, idx)
+	tc, tcArgs, _, err := scopeClause(ctx, idx)
 	if err != nil {
 		return nil, err
 	}
@@ -393,7 +393,7 @@ func (s *PGKnowledgeGraphStore) DeleteRelation(ctx context.Context, agentID, use
 	aid := mustParseUUID(agentID)
 	rid := mustParseUUID(relationID)
 	if store.IsSharedKG(ctx) {
-		tc, tcArgs, err := tenantClauseN(ctx, 3)
+		tc, tcArgs, _, err := scopeClause(ctx, 3)
 		if err != nil {
 			return err
 		}
@@ -403,7 +403,7 @@ func (s *PGKnowledgeGraphStore) DeleteRelation(ctx context.Context, agentID, use
 		)
 		return err
 	}
-	tc, tcArgs, err := tenantClauseN(ctx, 4)
+	tc, tcArgs, _, err := scopeClause(ctx, 4)
 	if err != nil {
 		return err
 	}
@@ -421,7 +421,7 @@ func (s *PGKnowledgeGraphStore) ListRelations(ctx context.Context, agentID, user
 	var q string
 	var args []any
 	if store.IsSharedKG(ctx) {
-		tc, tcArgs, err := tenantClauseN(ctx, 3)
+		tc, tcArgs, _, err := scopeClause(ctx, 3)
 		if err != nil {
 			return nil, err
 		}
@@ -433,7 +433,7 @@ func (s *PGKnowledgeGraphStore) ListRelations(ctx context.Context, agentID, user
 		ORDER BY created_at DESC`
 		args = append([]any{aid, eid}, tcArgs...)
 	} else {
-		tc, tcArgs, err := tenantClauseN(ctx, 4)
+		tc, tcArgs, _, err := scopeClause(ctx, 4)
 		if err != nil {
 			return nil, err
 		}
@@ -467,7 +467,7 @@ func (s *PGKnowledgeGraphStore) ListAllRelations(ctx context.Context, agentID, u
 		args = append(args, userID)
 		idx++
 	}
-	tc, tcArgs, err := tenantClauseN(ctx, idx)
+	tc, tcArgs, _, err := scopeClause(ctx, idx)
 	if err != nil {
 		return nil, err
 	}
@@ -594,7 +594,7 @@ func (s *PGKnowledgeGraphStore) PruneByConfidence(ctx context.Context, agentID,
 	var res sql.Result
 	var err error
 	if store.IsSharedKG(ctx) {
-		tc, tcArgs, tcErr := tenantClauseN(ctx, 3)
+		tc, tcArgs, _, tcErr := scopeClause(ctx, 3)
 		if tcErr != nil {
 			return 0, tcErr
 		}
@@ -603,7 +603,7 @@ func (s *PGKnowledgeGraphStore) PruneByConfidence(ctx context.Context, agentID,
 			append([]any{aid, minConfidence}, tcArgs...)...,
 		)
 	} else {
-		tc, tcArgs, tcErr := tenantClauseN(ctx, 4)
+		tc, tcArgs, _, tcErr := scopeClause(ctx, 4)
 		if tcErr != nil {
 			return 0, tcErr
 		}
@@ -631,7 +631,7 @@ func (s *PGKnowledgeGraphStore) Stats(ctx context.Context, agentID, userID strin
 		args = append(args, userID)
 		idx++
 	}
-	tc, tcArgs, err := tenantClauseN(ctx, idx)
+	tc, tcArgs, _, err := scopeClause(ctx, idx)
 	if err != nil {
 		return nil, err
 	}
diff --git a/internal/store/pg/knowledge_graph_embedding.go b/internal/store/pg/knowledge_graph_embedding.go
index 96dcaea2..864462a9 100644
--- a/internal/store/pg/knowledge_graph_embedding.go
+++ b/internal/store/pg/knowledge_graph_embedding.go
@@ -19,7 +19,7 @@ func (s *PGKnowledgeGraphStore) BackfillKGEmbeddings(ctx context.Context) (int,
 	total := 0
 
 	// $1=batchSize (LIMIT), tenant at $2 if not cross-tenant
-	tc, tcArgs, tcErr := tenantClauseN(ctx, 2)
+	tc, tcArgs, _, tcErr := scopeClause(ctx, 2)
 	if tcErr != nil {
 		return 0, tcErr
 	}
diff --git a/internal/store/pg/knowledge_graph_traversal.go b/internal/store/pg/knowledge_graph_traversal.go
index 669470f4..b1e7de9d 100644
--- a/internal/store/pg/knowledge_graph_traversal.go
+++ b/internal/store/pg/knowledge_graph_traversal.go
@@ -35,7 +35,7 @@ func (s *PGKnowledgeGraphStore) Traverse(ctx context.Context, agentID, userID, s
 	var args []any
 	if store.IsSharedKG(ctx) {
 		// fixed params: $1=startID, $2=aid; tenant at $3 (if needed); maxDepth last
-		tc, tcArgs, tcErr := tenantClauseN(ctx, 3)
+		tc, tcArgs, _, tcErr := scopeClause(ctx, 3)
 		if tcErr != nil {
 			return nil, tcErr
 		}
@@ -80,7 +80,7 @@ func (s *PGKnowledgeGraphStore) Traverse(ctx context.Context, agentID, userID, s
 		args = append(args, maxDepth)
 	} else {
 		// fixed params: $1=startID, $2=aid, $3=userID; tenant at $4 (if needed); maxDepth last
-		tc, tcArgs, tcErr := tenantClauseN(ctx, 4)
+		tc, tcArgs, _, tcErr := scopeClause(ctx, 4)
 		if tcErr != nil {
 			return nil, tcErr
 		}
diff --git a/internal/store/pg/mcp_servers_access.go b/internal/store/pg/mcp_servers_access.go
index 0ab6dcea..f05402c5 100644
--- a/internal/store/pg/mcp_servers_access.go
+++ b/internal/store/pg/mcp_servers_access.go
@@ -37,7 +37,7 @@ func (s *PGMCPServerStore) GrantToAgent(ctx context.Context, g *store.MCPAgentGr
 }
 
 func (s *PGMCPServerStore) RevokeFromAgent(ctx context.Context, serverID, agentID uuid.UUID) error {
-	tClause, tArgs, err := tenantClauseN(ctx, 3)
+	tClause, tArgs, _, err := scopeClause(ctx, 3)
 	if err != nil {
 		return err
 	}
@@ -48,7 +48,7 @@ func (s *PGMCPServerStore) RevokeFromAgent(ctx context.Context, serverID, agentI
 }
 
 func (s *PGMCPServerStore) ListAgentGrants(ctx context.Context, agentID uuid.UUID) ([]store.MCPAgentGrant, error) {
-	tClause, tArgs, err := tenantClauseN(ctx, 2)
+	tClause, tArgs, _, err := scopeClause(ctx, 2)
 	if err != nil {
 		return nil, err
 	}
@@ -74,7 +74,7 @@ func (s *PGMCPServerStore) ListAgentGrants(ctx context.Context, agentID uuid.UUI
 }
 
 func (s *PGMCPServerStore) ListServerGrants(ctx context.Context, serverID uuid.UUID) ([]store.MCPAgentGrant, error) {
-	tClause, tArgs, err := tenantClauseN(ctx, 2)
+	tClause, tArgs, _, err := scopeClause(ctx, 2)
 	if err != nil {
 		return nil, err
 	}
@@ -104,7 +104,7 @@ func (s *PGMCPServerStore) ListServerGrants(ctx context.Context, serverID uuid.U
 // --- Counts ---
 
 func (s *PGMCPServerStore) CountAgentGrantsByServer(ctx context.Context) (map[uuid.UUID]int, error) {
-	tClause, tArgs, err := tenantClauseN(ctx, 1)
+	tClause, tArgs, _, err := scopeClause(ctx, 1)
 	if err != nil {
 		return nil, err
 	}
@@ -155,7 +155,7 @@ func (s *PGMCPServerStore) GrantToUser(ctx context.Context, g *store.MCPUserGran
 }
 
 func (s *PGMCPServerStore) RevokeFromUser(ctx context.Context, serverID uuid.UUID, userID string) error {
-	tClause, tArgs, err := tenantClauseN(ctx, 3)
+	tClause, tArgs, _, err := scopeClause(ctx, 3)
 	if err != nil {
 		return err
 	}
@@ -168,7 +168,7 @@ func (s *PGMCPServerStore) RevokeFromUser(ctx context.Context, serverID uuid.UUI
 // --- Resolution ---
 
 func (s *PGMCPServerStore) ListAccessible(ctx context.Context, agentID uuid.UUID, userID string) ([]store.MCPAccessInfo, error) {
-	tClause, tArgs, err := tenantClauseNAlias(ctx, 3, "ms")
+	tClause, tArgs, _, err := scopeClauseAlias(ctx, 3, "ms")
 	if err != nil {
 		return nil, err
 	}
@@ -252,7 +252,7 @@ func (s *PGMCPServerStore) CreateRequest(ctx context.Context, req *store.MCPAcce
 }
 
 func (s *PGMCPServerStore) ListPendingRequests(ctx context.Context) ([]store.MCPAccessRequest, error) {
-	tClause, tArgs, err := tenantClauseN(ctx, 1)
+	tClause, tArgs, _, err := scopeClause(ctx, 1)
 	if err != nil {
 		return nil, err
 	}
@@ -300,7 +300,7 @@ func (s *PGMCPServerStore) ReviewRequest(ctx context.Context, requestID uuid.UUI
 	var req store.MCPAccessRequest
 	var agentID *uuid.UUID
 	var userID *string
-	tClause, tArgs, err2 := tenantClauseN(ctx, 2)
+	tClause, tArgs, _, err2 := scopeClause(ctx, 2)
 	if err2 != nil {
 		return err2
 	}
diff --git a/internal/store/pg/memory_admin.go b/internal/store/pg/memory_admin.go
index d0d8bf7f..5c8d66c3 100644
--- a/internal/store/pg/memory_admin.go
+++ b/internal/store/pg/memory_admin.go
@@ -53,7 +53,7 @@ func (s *PGMemoryStore) ListAllDocumentsGlobal(ctx context.Context) ([]store.Doc
 // ListAllDocuments returns all documents for an agent across all users (global + personal).
 func (s *PGMemoryStore) ListAllDocuments(ctx context.Context, agentID string) ([]store.DocumentInfo, error) {
 	aid := mustParseUUID(agentID)
-	tc, tcArgs, err := tenantClauseN(ctx, 2)
+	tc, tcArgs, _, err := scopeClause(ctx, 2)
 	if err != nil {
 		return nil, err
 	}
@@ -95,7 +95,7 @@ func (s *PGMemoryStore) GetDocumentDetail(ctx context.Context, agentID, userID,
 	var q string
 	var args []any
 	if userID == "" {
-		tc, tcArgs, err := tenantClauseNAlias(ctx, 3, "d")
+		tc, tcArgs, _, err := scopeClauseAlias(ctx, 3, "d")
 		if err != nil {
 			return nil, err
 		}
@@ -108,7 +108,7 @@ func (s *PGMemoryStore) GetDocumentDetail(ctx context.Context, agentID, userID,
 			 GROUP BY d.id`
 		args = append([]any{aid, path}, tcArgs...)
 	} else {
-		tc, tcArgs, err := tenantClauseNAlias(ctx, 4, "d")
+		tc, tcArgs, _, err := scopeClauseAlias(ctx, 4, "d")
 		if err != nil {
 			return nil, err
 		}
@@ -148,7 +148,7 @@ func (s *PGMemoryStore) ListChunks(ctx context.Context, agentID, userID, path st
 	var q string
 	var args []any
 	if userID == "" {
-		tc, tcArgs, err := tenantClauseNAlias(ctx, 3, "d")
+		tc, tcArgs, _, err := scopeClauseAlias(ctx, 3, "d")
 		if err != nil {
 			return nil, err
 		}
@@ -161,7 +161,7 @@ func (s *PGMemoryStore) ListChunks(ctx context.Context, agentID, userID, path st
 			 ORDER BY c.start_line`
 		args = append([]any{aid, path}, tcArgs...)
 	} else {
-		tc, tcArgs, err := tenantClauseNAlias(ctx, 4, "d")
+		tc, tcArgs, _, err := scopeClauseAlias(ctx, 4, "d")
 		if err != nil {
 			return nil, err
 		}
diff --git a/internal/store/pg/memory_docs.go b/internal/store/pg/memory_docs.go
index c06f551b..0626537e 100644
--- a/internal/store/pg/memory_docs.go
+++ b/internal/store/pg/memory_docs.go
@@ -48,7 +48,7 @@ func (s *PGMemoryStore) GetDocument(ctx context.Context, agentID, userID, path s
 
 	var err error
 	if userID == "" {
-		tc, tcArgs, tcErr := tenantClauseN(ctx, 3)
+		tc, tcArgs, _, tcErr := scopeClause(ctx, 3)
 		if tcErr != nil {
 			return "", tcErr
 		}
@@ -56,7 +56,7 @@ func (s *PGMemoryStore) GetDocument(ctx context.Context, agentID, userID, path s
 			"SELECT content FROM memory_documents WHERE agent_id = $1 AND path = $2 AND user_id IS NULL"+tc,
 			append([]any{aid, path}, tcArgs...)...).Scan(&content)
 	} else {
-		tc, tcArgs, tcErr := tenantClauseN(ctx, 4)
+		tc, tcArgs, _, tcErr := scopeClause(ctx, 4)
 		if tcErr != nil {
 			return "", tcErr
 		}
@@ -97,7 +97,7 @@ func (s *PGMemoryStore) DeleteDocument(ctx context.Context, agentID, userID, pat
 	var res sql.Result
 	var err error
 	if userID == "" {
-		tc, tcArgs, tcErr := tenantClauseN(ctx, 3)
+		tc, tcArgs, _, tcErr := scopeClause(ctx, 3)
 		if tcErr != nil {
 			return tcErr
 		}
@@ -105,7 +105,7 @@ func (s *PGMemoryStore) DeleteDocument(ctx context.Context, agentID, userID, pat
 			"DELETE FROM memory_documents WHERE agent_id = $1 AND path = $2 AND user_id IS NULL"+tc,
 			append([]any{aid, path}, tcArgs...)...)
 	} else {
-		tc, tcArgs, tcErr := tenantClauseN(ctx, 4)
+		tc, tcArgs, _, tcErr := scopeClause(ctx, 4)
 		if tcErr != nil {
 			return tcErr
 		}
@@ -129,7 +129,7 @@ func (s *PGMemoryStore) ListDocuments(ctx context.Context, agentID, userID strin
 	var rows *sql.Rows
 	var err error
 	if userID == "" {
-		tc, tcArgs, tcErr := tenantClauseN(ctx, 2)
+		tc, tcArgs, _, tcErr := scopeClause(ctx, 2)
 		if tcErr != nil {
 			return nil, tcErr
 		}
@@ -137,7 +137,7 @@ func (s *PGMemoryStore) ListDocuments(ctx context.Context, agentID, userID strin
 			"SELECT path, hash, user_id, updated_at FROM memory_documents WHERE agent_id = $1 AND user_id IS NULL"+tc,
 			append([]any{aid}, tcArgs...)...)
 	} else {
-		tc, tcArgs, tcErr := tenantClauseN(ctx, 3)
+		tc, tcArgs, _, tcErr := scopeClause(ctx, 3)
 		if tcErr != nil {
 			return nil, tcErr
 		}
@@ -184,7 +184,7 @@ func (s *PGMemoryStore) IndexDocument(ctx context.Context, agentID, userID, path
 	// Get document ID
 	var docID uuid.UUID
 	if userID == "" {
-		tc, tcArgs, tcErr := tenantClauseN(ctx, 3)
+		tc, tcArgs, _, tcErr := scopeClause(ctx, 3)
 		if tcErr != nil {
 			return tcErr
 		}
@@ -192,7 +192,7 @@ func (s *PGMemoryStore) IndexDocument(ctx context.Context, agentID, userID, path
 			"SELECT id FROM memory_documents WHERE agent_id = $1 AND path = $2 AND user_id IS NULL"+tc,
 			append([]any{aid, path}, tcArgs...)...).Scan(&docID)
 	} else {
-		tc, tcArgs, tcErr := tenantClauseN(ctx, 4)
+		tc, tcArgs, _, tcErr := scopeClause(ctx, 4)
 		if tcErr != nil {
 			return tcErr
 		}
diff --git a/internal/store/pg/memory_search.go b/internal/store/pg/memory_search.go
index 6d55585c..80abfc89 100644
--- a/internal/store/pg/memory_search.go
+++ b/internal/store/pg/memory_search.go
@@ -84,7 +84,7 @@ func (s *PGMemoryStore) ftsSearch(ctx context.Context, query string, agentID any
 	if userID != "" {
 		// fixed params: $1=query, $2=agentID, $3=query, $4=userID
 		// tenant clause appended at $5 (if filtered), then LIMIT at $5 or $6
-		tc, tcArgs, err := tenantClauseN(ctx, 5)
+		tc, tcArgs, _, err := scopeClause(ctx, 5)
 		if err != nil {
 			return nil, err
 		}
@@ -100,7 +100,7 @@ func (s *PGMemoryStore) ftsSearch(ctx context.Context, query string, agentID any
 	} else {
 		// fixed params: $1=query, $2=agentID, $3=query
 		// tenant clause at $4 (if filtered), then LIMIT at $4 or $5
-		tc, tcArgs, err := tenantClauseN(ctx, 4)
+		tc, tcArgs, _, err := scopeClause(ctx, 4)
 		if err != nil {
 			return nil, err
 		}
@@ -139,7 +139,7 @@ func (s *PGMemoryStore) vectorSearch(ctx context.Context, embedding []float32, a
 	if userID != "" {
 		// fixed params: $1=vec, $2=agentID, $3=userID
 		// tenant clause at $4, then ORDER vec at $4+len(tcArgs), LIMIT after
-		tc, tcArgs, err := tenantClauseN(ctx, 4)
+		tc, tcArgs, _, err := scopeClause(ctx, 4)
 		if err != nil {
 			return nil, err
 		}
@@ -156,7 +156,7 @@ func (s *PGMemoryStore) vectorSearch(ctx context.Context, embedding []float32, a
 	} else {
 		// fixed params: $1=vec, $2=agentID
 		// tenant clause at $3, then ORDER vec at $3+len(tcArgs), LIMIT after
-		tc, tcArgs, err := tenantClauseN(ctx, 3)
+		tc, tcArgs, _, err := scopeClause(ctx, 3)
 		if err != nil {
 			return nil, err
 		}
diff --git a/internal/store/pg/pending_message_store.go b/internal/store/pg/pending_message_store.go
index ec340fa4..cb501bec 100644
--- a/internal/store/pg/pending_message_store.go
+++ b/internal/store/pg/pending_message_store.go
@@ -54,7 +54,7 @@ func (s *PGPendingMessageStore) AppendBatch(ctx context.Context, msgs []store.Pe
 }
 
 func (s *PGPendingMessageStore) ListByKey(ctx context.Context, channelName, historyKey string) ([]store.PendingMessage, error) {
-	tClause, tArgs, err := tenantClauseN(ctx, 3)
+	tClause, tArgs, _, err := scopeClause(ctx, 3)
 	if err != nil {
 		return nil, err
 	}
@@ -82,7 +82,7 @@ func (s *PGPendingMessageStore) ListByKey(ctx context.Context, channelName, hist
 }
 
 func (s *PGPendingMessageStore) DeleteByKey(ctx context.Context, channelName, historyKey string) error {
-	tClause, tArgs, err := tenantClauseN(ctx, 3)
+	tClause, tArgs, _, err := scopeClause(ctx, 3)
 	if err != nil {
 		return err
 	}
@@ -157,7 +157,7 @@ func (s *PGPendingMessageStore) DeleteStale(ctx context.Context, olderThan time.
 }
 
 func (s *PGPendingMessageStore) ListGroups(ctx context.Context) ([]store.PendingMessageGroup, error) {
-	tClause, tArgs, err := tenantClauseN(ctx, 1)
+	tClause, tArgs, _, err := scopeClause(ctx, 1)
 	if err != nil {
 		return nil, err
 	}
@@ -205,7 +205,7 @@ func (s *PGPendingMessageStore) ListGroups(ctx context.Context) ([]store.Pending
 }
 
 func (s *PGPendingMessageStore) CountAll(ctx context.Context) (int64, error) {
-	tClause, tArgs, err := tenantClauseN(ctx, 1)
+	tClause, tArgs, _, err := scopeClause(ctx, 1)
 	if err != nil {
 		return 0, err
 	}
@@ -221,7 +221,7 @@ func (s *PGPendingMessageStore) CountAll(ctx context.Context) (int64, error) {
 }
 
 func (s *PGPendingMessageStore) CountByKey(ctx context.Context, channelName, historyKey string) (int, error) {
-	tClause, tArgs, err := tenantClauseN(ctx, 3)
+	tClause, tArgs, _, err := scopeClause(ctx, 3)
 	if err != nil {
 		return 0, err
 	}
diff --git a/internal/store/pg/skills_embedding.go b/internal/store/pg/skills_embedding.go
index 468ad105..97737553 100644
--- a/internal/store/pg/skills_embedding.go
+++ b/internal/store/pg/skills_embedding.go
@@ -23,7 +23,7 @@ func (s *PGSkillStore) SearchByEmbedding(ctx context.Context, embedding []float3
 	vecStr := vectorToString(embedding)
 
 	// $1=vec, $2=vec → tenant at $3 (if needed), ORDER vec at $3+len(tcArgs), LIMIT after
-	tc, tcArgs, err := tenantClauseN(ctx, 3)
+	tc, tcArgs, _, err := scopeClause(ctx, 3)
 	if err != nil {
 		return nil, err
 	}
diff --git a/internal/store/pg/skills_grants.go b/internal/store/pg/skills_grants.go
index f5273b4e..aec9a9a8 100644
--- a/internal/store/pg/skills_grants.go
+++ b/internal/store/pg/skills_grants.go
@@ -44,7 +44,7 @@ func (s *PGSkillStore) GrantToAgent(ctx context.Context, skillID, agentID uuid.U
 // RevokeFromAgent revokes a skill grant from an agent.
 // Auto-demotes visibility from 'internal' back to 'private' when no agent grants remain.
 func (s *PGSkillStore) RevokeFromAgent(ctx context.Context, skillID, agentID uuid.UUID) error {
-	tClause, tArgs, err := tenantClauseN(ctx, 3)
+	tClause, tArgs, _, err := scopeClause(ctx, 3)
 	if err != nil {
 		return err
 	}
@@ -73,7 +73,7 @@ func (s *PGSkillStore) RevokeFromAgent(ctx context.Context, skillID, agentID uui
 
 // ListAgentGrants returns all skill grants for an agent.
 func (s *PGSkillStore) ListAgentGrants(ctx context.Context, agentID uuid.UUID) ([]SkillGrantInfo, error) {
-	tClause, tArgs, err := tenantClauseN(ctx, 2)
+	tClause, tArgs, _, err := scopeClause(ctx, 2)
 	if err != nil {
 		return nil, err
 	}
@@ -116,7 +116,7 @@ func (s *PGSkillStore) GrantToUser(ctx context.Context, skillID uuid.UUID, userI
 
 // RevokeFromUser revokes a skill grant from a user.
 func (s *PGSkillStore) RevokeFromUser(ctx context.Context, skillID uuid.UUID, userID string) error {
-	tClause, tArgs, err := tenantClauseN(ctx, 3)
+	tClause, tArgs, _, err := scopeClause(ctx, 3)
 	if err != nil {
 		return err
 	}
@@ -131,7 +131,7 @@ func (s *PGSkillStore) RevokeFromUser(ctx context.Context, skillID uuid.UUID, us
 // System skills (is_system=true) are always visible regardless of tenant.
 func (s *PGSkillStore) ListAccessible(ctx context.Context, agentID uuid.UUID, userID string) ([]store.SkillInfo, error) {
 	// tenant filter: system skills bypass it, tenant-owned skills are filtered
-	tc, tcArgs, err := tenantClauseN(ctx, 3)
+	tc, tcArgs, _, err := scopeClause(ctx, 3)
 	if err != nil {
 		return nil, err
 	}
@@ -202,7 +202,7 @@ type SkillWithGrantStatus struct {
 
 // ListWithGrantStatus returns all active skills with grant status for a specific agent.
 func (s *PGSkillStore) ListWithGrantStatus(ctx context.Context, agentID uuid.UUID) ([]SkillWithGrantStatus, error) {
-	tc, tcArgs, err := tenantClauseN(ctx, 2)
+	tc, tcArgs, _, err := scopeClause(ctx, 2)
 	if err != nil {
 		return nil, err
 	}
diff --git a/internal/store/pg/teams.go b/internal/store/pg/teams.go
index c16e8bf2..2f012324 100644
--- a/internal/store/pg/teams.go
+++ b/internal/store/pg/teams.go
@@ -370,7 +370,7 @@ func (s *PGTeamStore) GrantTeamAccess(ctx context.Context, teamID uuid.UUID, use
 }
 
 func (s *PGTeamStore) RevokeTeamAccess(ctx context.Context, teamID uuid.UUID, userID string) error {
-	tClause, tArgs, err := tenantClauseN(ctx, 3)
+	tClause, tArgs, _, err := scopeClause(ctx, 3)
 	if err != nil {
 		return err
 	}
@@ -381,7 +381,7 @@ func (s *PGTeamStore) RevokeTeamAccess(ctx context.Context, teamID uuid.UUID, us
 }
 
 func (s *PGTeamStore) ListTeamGrants(ctx context.Context, teamID uuid.UUID) ([]store.TeamUserGrant, error) {
-	tClause, tArgs, err := tenantClauseN(ctx, 2)
+	tClause, tArgs, _, err := scopeClause(ctx, 2)
 	if err != nil {
 		return nil, err
 	}
@@ -447,7 +447,7 @@ func (s *PGTeamStore) ListUserTeams(ctx context.Context, userID string) ([]store
 }
 
 func (s *PGTeamStore) HasTeamAccess(ctx context.Context, teamID uuid.UUID, userID string) (bool, error) {
-	tClause, tArgs, err := tenantClauseN(ctx, 3)
+	tClause, tArgs, _, err := scopeClause(ctx, 3)
 	if err != nil {
 		return false, err
 	}